The Lost Encrypted Laptop
An employee's company laptop is stolen from a locked car. The laptop has full-disk encryption enabled, a strong login password, and a remote-wipe capability that the company has not yet activated because the employee is on holiday and cannot confirm consent. The laptop holds 400 client records including names, addresses and case notes, plus a spreadsheet of supplier bank details. The theft is reported to the police. The company's incident policy says data breaches must be assessed 'without undue delay'. The IT manager argues that because the disk is encrypted, no breach needs to be reported and nothing further is required.
1. Evaluate the IT manager's claim that encryption means no further action is needed.
Read the worked answer
The claim is too strong. Encryption is a strong mitigating factor: if the disk is properly encrypted and the key is not stored with the device, the data is likely unintelligible to a thief, which can reduce the risk to individuals. But that is an assessment, not an automatic exemption.
Factors to check before concluding 'no risk':
- Was encryption actually active and verified, or merely configured?
- Is the login password strong and not written down or stored with the laptop?
- Are the supplier bank details also within the encrypted volume?
- Is there any chance the device was powered on and unlocked at theft?
Process failures remain: Remote wipe was not activated, so a control that should have been used was left unused. The incident still needs to be logged, assessed and documented. The conclusion may be 'low risk, no notification required', but that conclusion must be reached and recorded, not assumed.
2. Outline the steps the company should take now, and explain why documentation matters even if no notification is made.
Read the worked answer
Steps:
- Contain: Activate remote wipe as soon as authorisation allows; do not wait indefinitely for the employee's consent if policy permits override in an incident.
- Assess: Confirm encryption status and key management; determine what data was on the device and the likelihood of harm to individuals.
- Record: Log the incident, the assessment, the decision and the reasoning.
- Notify if required: If the assessment shows a risk to individuals' rights and freedoms, notify the relevant authority without undue delay and inform affected individuals where the risk is high.
- Review: Fix the process gap that left remote wipe unactivated and clarify who can authorise it during absence.
Why documentation matters: It demonstrates accountability and due care, supports any regulatory enquiry, and provides the evidence trail if the assessment is later challenged. An undocumented 'we decided it was fine' is indistinguishable from having done nothing.